0 Fork 0

Files

T

keb 10dc747f0f feat: keep what was loaded between runs, and start where you left off (#2 )

Starting lazysecrets again now shows what you had loaded at once, and puts you back where you were.

- **Cache file** `~/.cache/lazysecrets/cache.json` (0600, written atomically): the Sources lists, vaults/scopes, secrets' metadata, Describe results and each list's cursor. **Never values**, and never repos (they're on disk anyway). Loaded on start; lists older than 2 minutes reload in the background as before. Saved every 30s when changed, and on quit.
- **Housekeeping:** entries not loaded for 30 days are dropped, as is everything from accounts no longer signed in (every cache key starts with the account ID). The file has a format version; another version is ignored and replaced. `cache: false` turns it off; `--demo` never uses it.
- **Sources are cached too:** Azure lists subscriptions over the network, so without this the Sources pane would still wait.
- **Go to** searches everything cached straight away, and its background loading now also refreshes lists from an earlier run instead of skipping them.
- **Where you left off:** the state file remembers the selected source, vault or secret per folder (the `--dir` or working directory, 100 most recent folders), and the next start in that folder goes back there quietly (no error if it's gone). Starting on a link skips it.

Docs: `cache:` in config.md, a Cache section, the place in State, and the README Privacy section now mentions the cache file.

Tests: cache round trip with a backend too slow to answer (lists and cursor come from the file), no value in the file, file mode 0600, old and signed-out entries dropped, back where it was left, not for another folder or a link.

This touches `app.go` near PR #1's changes (Model fields, the Update switch), so whichever merges second needs a small conflict fix.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #2

2026-10-11 09:53:32 +02:00

6.2 KiB

Raw Blame History

Config

Optional, at ~/.config/lazysecrets/config.yaml (or $XDG_CONFIG_HOME/lazysecrets/config.yaml, or --config). Flags override it. Unknown keys are an error, so typos don't go unnoticed.

icons: true            # Nerd Font icons (v3+); also --icons=false or LAZYSECRETS_ICONS=0
clipboardClear: 30s    # clear copied values from the clipboard after this long; 0s disables
revealTimeout: 60s     # hide a revealed value after this long; 0s keeps it shown
hideOnBlur: true       # hide a revealed value when the terminal loses focus (tmux: focus-events on)
expiryWarningDays: 30  # mark secrets, keys and certificates expiring this soon (⚠ 12d); expired ones get ✗
timeout: 30s           # per backend request
loadDelay: 150ms       # how long the cursor rests on a row before it loads; 0s loads at once
sourcesView: grouped   # or flat; ` toggles it
collapseGroups: true   # start with the Sources pane's groups folded; enter or space unfolds one
updateCheck: true      # look for a newer release once a day (U and lazysecrets update work either way)
history: true          # count uses of items for Recent (R)
cache: true            # keep what was loaded (never values) for the next start
providers:
  azure:                                 # applies to every az account
    enabled: true                        # default
    hideSubscriptions: [platform-mgmt]   # by name or ID
    vaults:                              # listed under "Pinned vaults", for vaults
      - https://kv-foo.vault.azure.net/  # you can read but not discover
  databricks:
    enabled: true
    hideProfiles: [test]
  repos:
    enabled: true
    roots: [~/git]
    paths: [~/work/infra]
    include: ["secrets/**"]
    exclude: ["**/testdata/**"]

More, each on its own page: repos (providers.repos), the link handler (linkHandler), keybindings (keybinding) and custom commands (customCommands).

Clipboard

The clipboard is the system clipboard locally and OSC52 over SSH (your terminal must allow OSC52 writes; in tmux, set -g set-clipboard on).

Theme

Colours follow your terminal's 16-colour palette by default. A theme: section overrides roles with hex colours, palette numbers (0-255) or names, plus attributes (bold, italic, underline, reverse, faint). Role names follow lazygit's gui.theme where they mean the same thing:

theme:
  activeBorderColor: ["#ff966c", bold]   # focused pane
  inactiveBorderColor: ["#589ed7"]
  selectedLineBgColor: ["#2d3f76"]       # cursor row background (default: palette 8)
  inactiveViewSelectedLineBgColor: ["#2f334d"]
  defaultFgColor: ["#c8d3f5"]
  optionsTextColor: ["#82aaff"]          # keys and labels
  searchMatchColor: ["#ffc777", bold]
  errorColor: ["#c53b53"]                # ✗ failures
  noticeColor: ["#c3e88d"]
  successColor: ["#c3e88d", bold]        # the ✓ before confirmations
  warningColor: ["#ffc777"]              # ⚠ what can't be done here
  mutedColor: ["#636da6"]
  favouriteColor: ["#ffc777"]
  valueColor: ["#ffc777"]
  azureColor: ["#82aaff"]
  databricksColor: ["#ff757f"]
  repoColor: ["#c099ff"]

Icons need a Nerd Font (v3+). If they render as boxes, turn them off with icons: false.

Layering

Several config files can be layered, later ones winning (theme roles and keybindings merge one by one), with a comma-separated --config or LAZYSECRETS_CONFIG_FILE, like lazygit's LG_CONFIG_FILE. An editor plugin can so add a generated theme file to your own config, the way snacks.nvim themes lazygit from Neovim's highlight groups:

LAZYSECRETS_CONFIG_FILE=~/.config/lazysecrets/config.yaml,~/.cache/nvim/lazysecrets-theme.yml lazysecrets

State

Stars, notes, usage and the layout are kept in ~/.local/state/lazysecrets/state.json ($XDG_STATE_HOME), readable only by you: one record per source, vault or secret, keyed by its lazysecrets:// link, never with values. A star belongs to the account you starred the item under (a vault two of your accounts can see can be starred for one); a note describes the item, so it shows under every account. It's JSON so an editor plugin can read it with a built-in parser; several lazysecrets windows can save to it without losing each other's changes.

Revealing, copying, opening in the browser, sharing and jumping to an item count as using it: its record keeps when it was last used and how often, for Recent (R). Records kept only for usage are dropped after 90 days unused, and beyond the 100 most recent. history: false stops counting.

It also keeps where you left lazysecrets in each folder (the selected source, vault or secret), and goes back there the next time it starts in that folder, unless it was started on a link.

Cache

What lazysecrets has loaded is kept in ~/.cache/lazysecrets/cache.json ($XDG_CACHE_HOME), readable only by you: the Sources lists, vaults and scopes, and secrets' names and metadata (tags, dates, references), never values. On the next start they show at once, and anything older than two minutes reloads in the background when you go to it, or when Go to searches it. Revealing and copying always fetch the value live.

Lists not loaded for 30 days are dropped, and so is everything from an account you're no longer signed in to. Repos aren't cached: their files are read from disk anyway. Deleting the file is always safe, and cache: false stops using it.

Updates

Once a day (updateCheck), in the background, lazysecrets asks the release server for the latest release; within the day it reuses the answer from the state file. Offline, or with the server down, it says nothing. A newer release shows in the footer, v0.1.1 ↑ v0.2.0; U (or lazysecrets update --check) shows its changelog.

Updating (u there, or lazysecrets update) downloads the release for your OS and CPU, checks it against the release's checksums.txt, makes sure it runs, and only then replaces the binary, atomically: a lazysecrets that's running keeps working, and the next start is the new version. A binary a package manager owns (Homebrew, Nix, a distro package) is left to it. Development builds (dev-…) aren't offered releases.

6.2 KiB Raw Blame History